John_Pork_is_calling[.][.][.][.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

John_Pork_is_calling....exe
Size

23.1MB
MD5

1196ac2e73defb6648c6e995a3879f5e
SHA1

429273a7448b717bc3abe0097656cf34e16bd520
SHA256

9c0854f0c0142b894467d9acca5e8dfdb6782db8a028a20595ce87fb2b0f6041
SHA512

7720135328740e2671a3568f44b485c3f595c46a94288340fab19a987f478da9ef51de2496b37cb5afe76c469edba5ec9053724f34dfe5e4da9655462c678acd
SSDEEP

393216:ajA41pnAHmlC+R1k+W1whDabwQ6sLIf0kYZMyPmNCnqFrsc64T926uER5kWzRkzI:Abr9TQ6SiBNCnqFrSU926fLLz2k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
John_Pork_is_calling....exe

Files

John_Pork_is_calling....exe
.exe windows:4 windows x86 arch:x86

768d2a1c9fec6851632cce17641ec571

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
wcscmp
memmove
wcslen
wcscpy
wcscat
sprintf
malloc
free
_wstat
_wcsdup
strcmp
floor
ceil
wcsncmp
fabs
fseek
ftell
fread
memcpy
fclose
pow
??3@YAXPAX@Z
wcsncpy
_wcsicmp
tolower
calloc
_lseeki64
_errno
realloc
abort
_close
_wopen
_setmode
exit
_open_osfhandle
strchr
_strdup
_snprintf
setlocale
strrchr
strncmp
wctomb
_get_osfhandle
_open
toupper
wcschr
mbstowcs
_vsnwprintf

kernel32

GetModuleHandleW
HeapCreate
HeapDestroy
ExitProcess
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
RemoveDirectoryW
FindResourceW
LoadResource
SizeofResource
GetCommandLineW
GetTempFileNameW
EnterCriticalSection
CloseHandle
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
CreateSemaphoreW
ReleaseSemaphore
CreateThread
TerminateThread
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
GetCurrentProcess
DuplicateHandle
CreatePipe
GetStdHandle
HeapAlloc
CreateProcessW
HeapFree
TerminateProcess
CreateFileW
GetFileSize
ReadFile
DeleteFileW
WriteFile
SetUnhandledExceptionFilter
Sleep
SetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
GetVersionExW
HeapReAlloc
TlsAlloc
MulDiv
SetFileAttributesW
MoveFileW
GetCurrentDirectoryW
GetDriveTypeW
FindFirstFileW
FindClose
GetFileAttributesW
GetTempPathW
CreateDirectoryW
SetFilePointer
SetEndOfFile
TlsFree
TlsGetValue
TlsSetValue
DeleteCriticalSection
InterlockedCompareExchange
InterlockedExchange
GetLastError
VirtualAlloc
VirtualFree
WideCharToMultiByte
MultiByteToWideChar
IsValidCodePage
GetACP
GetOEMCP
GetFileType
PeekNamedPipe
GetFileInformationByHandle
GetFileAttributesA
CreateFileA
GetExitCodeProcess
GetFullPathNameW
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject

gdiplus

GdipDeleteFont
GdipDeleteGraphics
GdipDeletePath
GdipDeleteMatrix
GdipDeletePen
GdipDeleteStringFormat
GdipFree
GdipGetDpiX
GdipGetDpiY

user32

FindWindowW
GetWindowThreadProcessId
ShowWindow
SetWindowPos
SetForegroundWindow
LoadIconW
SendMessageW
IsWindow
GetWindowRect
ClientToScreen
GetSystemMetrics
MoveWindow
MessageBoxW
GetForegroundWindow
IsWindowVisible
GetWindowLongW
IsWindowEnabled
EnableWindow
EnumWindows
DestroyWindow
CreateWindowExW
SetWindowLongW
CallWindowProcW
RemovePropW
DefWindowProcW
GetPropW
GetParent
SetPropW
GetWindow
SetActiveWindow
DestroyIcon
LoadCursorW
RegisterClassW
AdjustWindowRectEx
CreateAcceleratorTableW
UnregisterClassW
SetTimer
PeekMessageW
MsgWaitForMultipleObjects
GetMessageW
GetActiveWindow
TranslateAcceleratorW
GetAncestor
IsDialogMessageW
TranslateMessage
DispatchMessageW
IsZoomed
IsIconic
KillTimer
SetWindowTextW
DefFrameProcW
SetFocus
GetFocus
GetClientRect
FillRect
DestroyAcceleratorTable
SetRect
EnumChildWindows
PostMessageW
GetDC
ReleaseDC
GetKeyState
GetClassNameW
IsChild
RegisterWindowMessageW

gdi32

GetStockObject
DeleteObject
GetDeviceCaps
GetObjectW
CreateBitmap
CreateCompatibleDC
SelectObject
SetPixel
DeleteDC
CreateDIBSection
GetDIBits
BitBlt
GetObjectType
CreateDCW
CreateFontW

advapi32

CryptAcquireContextW
CryptGenRandom
CryptReleaseContext

comctl32

InitCommonControlsEx

ole32

CoInitialize
RevokeDragDrop

shell32

ShellExecuteExW

winmm

timeBeginPeriod

shlwapi

PathQuoteSpacesW
PathRemoveExtensionW
PathAddBackslashW

Sections

.code
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 262KB - Virtual size: 262KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22.4MB - Virtual size: 22.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

768d2a1c9fec6851632cce17641ec571

Headers

File Characteristics

Imports

msvcrt

kernel32

gdiplus

user32

gdi32

advapi32

comctl32

ole32

shell32

winmm

shlwapi

Sections

.code Size: 7KB - Virtual size: 7KB

.text Size: 262KB - Virtual size: 262KB

.rdata Size: 51KB - Virtual size: 51KB

.data Size: 11KB - Virtual size: 13KB

.rsrc Size: 22.4MB - Virtual size: 22.4MB

.code
Size: 7KB - Virtual size: 7KB

.text
Size: 262KB - Virtual size: 262KB

.rdata
Size: 51KB - Virtual size: 51KB

.data
Size: 11KB - Virtual size: 13KB

.rsrc
Size: 22.4MB - Virtual size: 22.4MB